It works fine except that pressing ENTER logs the last command again. This happens as many times as the enter key is pressed. And some users do have this habit! Is there a way to avoid these extra logs? Also, an obvious expectation from the solution will that a distinction between just pressing enter a few times and actually re-running the command be possible.

You mean like $history does? what you need to do is not process blank readlines. I will look into this later.
–
j0hDec 20 '13 at 17:11

That script might look like working fine, but it is likely not. If the user puts a space on the line before the command, then that command won't be logged in history, and because of that it won't be logged in your script also.
–
falconerDec 20 '13 at 17:57

2 Answers
2

I managed to solve the problem of repeated command logging triggered by the ENTER key by replacing the "history 1" invocation by "history -a >(tee -a $HISTFILE)". Subsequently, after the last command has been found and logged, "history -c; history -r" is run to remove all entries from the Bash's in-memory command list and regenerate the list from whatever has been saved in the history file. This is necessary to get only a single command the next time "history -a" is executed. Here is the solution:

If you look in each user's home directory, they should be a file called .bash_history. This is a hidden file, so in Nautilus you need to press Ctrl+H to view it, or with ls you need to use the -a option. This will contain the last 1000 commands the user has entered. So I would of thought you could just regularly log that file, instead of using the history command...

The method of logging commands via "logger" gets the message finally to /var/log/messages, which is less susceptible to get deleted than a file in a user's home directory. Also, this method helps log commands for all users and not just that of mine.
–
pdpMar 5 '14 at 15:12